Modello 231 and WHISTLEBLOWING

PCR-05

WHISTLEBLOWING PROTOCOL

REVISION A

DECEMBER 2023

CHANGE LOG:

CONTENTS

1.... REVIEW OF EXISTING LEGISLATION....................................................................................................................... 3

2.... PURPOSE AND SCOPE OF THE PROTOCOL.............................................................................................................. 5

3.... DEFINITIONS..................................................................................................................................................... 5

4.... REPORT SPECIFICATIONS.................................................................................................................................... 6

4.1..... OBJECT OFTHE REPORT..................................................................................................................................................................................... 6

4.2..... CONTENT OFTHE REPORT................................................................................................................................................................................. 6

4.3..... CASES EXCLUDED FROM THE APPLICATION OF THE WHISTLEBLOWINGREGULATIONS............................................................................................. 7

5.... WHISTLEBLOWING CHANNELS............................................................................................................................. 8

5.1..... INTERNAL CHANNEL: REPORTING BY PHYSICAL MAIL........................................................................................................................................... 8

5.2..... INTERNAL CHANNEL: ORAL REPORTS AND FACE-TO-FACE MEETINGS.................................................................................................................... 9

5.3..... ANONYMOUS REPORTS.................................................................................................................................................................................. 10

5.4..... EXTERNAL CHANNEL (ANAC PLATFORM)........................................................................................................................................................... 10

5.5..... PUBLIC DISCLOSURE....................................................................................................................................................................................... 10

6.... DUTIES OF THE WHISTLEBLOWER....................................................................................................................... 11

6.1..... VERIFICATIONOF THE VALIDITY OF THECONFIDENTIAL REPORT........................................................................................................................... 11

6.2..... VERIFICATION OF THE VALIDITY OF ANONYMOUS REPORTS............................................................................................................................... 12

7.... PROTECTION OF THE WHISTLEBLOWER............................................................................................................... 13

7.1..... PROHIBITION OF RETALIATION........................................................................................................................................................................ 13

7.2..... PROTECTION OF CONFIDENTIALITY.................................................................................................................................................................. 14

7.3..... SUBJECTIVE EXTENSION OF PROTECTION MEASURES......................................................................................................................................... 15

8.... LIABILITY OF THE WHISTLEBLOWER.................................................................................................................... 16

9.... SANCTION REGIME........................................................................................................................................... 17

1. REVIEW OF EXISTING LEGISLATION

The introduction into Italy's legislation of adequate protection for public and private employees who report unlawful conduct from within the workplace is provided for in international conventions (UN, OECD, Council of Europe) ratified by Italy, as well as in recommendations of the Parliamentary Assembly of the Council of Europe, sometimes as binding obligations, other times as formal invitations to comply.

In Italy, the concept of whistleblowing was introduced for the first time with Law no. 190/2012 (Provisions for the prevention and contrast of corruption and misconduct in the public administration), applying exclusively to the public administration, which, under Art. 1, paragraph 51, introduced Article 54-bis into Italian Legislative Decree no. 165 of 30 March 2001 (General provisions concerning employment at public entities), regulating a system of protections for public employees who report unlawful conduct of which they have become aware by reason of their employment relationship.

Subsequently, Legislative Decree no. 72/2015 made some amendments to:

• Legislative Decree no. 385/1993 (Consolidated Law on Banking - TUB), introducing the obligation for credit institutions to provide for specific, autonomous and independent channels for the reporting, by staff both internally and externally, of violations of the rules governing their activities, as well as mechanisms to ensure the confidentiality of the personal data of the whistleblower and of the reported person;
• Legislative Decree no. 58/1998 (Consolidated Law on Finance - TUF), introducing the adoption of whistleblowing procedures similar to those provided for in the Consolidated Law on Banking, by financial intermediaries and parent companies.

This was followed by Law no. 179/2017, concerning “Provisions for the protection of whistleblowers who report crimes or misconduct of which they become aware in the context of private or public employment,” which introduced for the first time the concept of whistleblowing in the private sector by amending Article 6 of Legislative Decree no. 231/2001, and made corrections to the rules on whistleblowing in the public sector by amending Article 54-bis of Legislative Decree no. 165/2001. As far as the private sector is concerned, this provision stipulated that the Organisational, Management and Control Models referred to in Legislative Decree no. 231/2001 should provide for:

1. one or more channels enabling senior persons or persons under their control or supervision - in order to protect the integrity of the entity - to make circumstantiated reports of unlawful conduct (as defined under the 231 Decree and based on precise and concordant factual elements) or violations of the Organisation and Management model, which come to their attention by virtue of their employment. Furthermore, the same article provided that such whistleblowing tools would guarantee the confidentiality of the identity of the whistleblower throughout the handling of the report;
2. the prohibition of direct or indirect retaliatory or discriminatory acts against the whistleblower, for reasons directly or indirectly related to the report;
3. within the disciplinary system, sanctions against those who violate the measures for the protection of the whistleblower, as well as against those who make reports that turn out to be unfounded and made with malice or gross negligence.

Most recently, Legislative Decree no. 24/2023, implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report breaches of domestic laws, was approved.

This had a number of impacts:

1. 1. for the private sector, it extended the scope of application of the whistleblowing mechanism, which was previously limited solely to reports of unlawful conduct relevant to the application of the rules set out in Legislative Decree no. 231/2001, which could be made solely through an internal channel within the entity. In doing so, this effectively extended the same organisational obligations for private entities and the same guarantees for whistleblowers provided for the public sector even beyond the scope of the 231/2001 regulations;
   2. it explicitly defined the concept of violation (see section 4.2 below);
   3. it provided for the establishment of three channels for reporting unlawful conduct: internal, external, public.

The first is the reporting channel that the entity is obliged to set up; the second is a platform of the National Anti-Corruption Authority (ANAC); the third, relating to public disclosure, uses the press or electronic media or means of disclosure capable of reaching a large number of people.

These are not three equivalent options but rather represent three steps on a ladder to be climbed in sequence if the conditions laid down by law are met;

1. 4. it also gave relevance to well-founded suspicions. Legislative Decree no. 24/2023 also extends the matters that may be reported to suspicions - provided that they are well-founded - and information based on concrete elements concerning “planned” violations that have yet to be committed;
   5. it extended the protection measures to both facilitators and persons linked by family/work/commercial relations with the whistleblower;
   6. it regulated anonymous reporting: an anonymous reporter, by definition, is not a whistleblower (a person who is already anonymous does not need protection, since they cannot be identified, nor are they a possible target of retaliation), but may become one if, for some reason, they are identified at a later stage, thereby losing their anonymity;
   7. it provided for an adaptation of the disciplinary system by the entity, with the introduction of sanctions against the perpetrators of direct or indirect retaliatory or discriminatory acts against the whistleblower/protected person, for reasons related directly or indirectly to the report, as well as against those who make reports that turn out to be unfounded and made with malice or gross negligence.

2. PURPOSE AND SCOPE OF THE PROTOCOL

This document aims to provide guidance on the correct implementation of the procedures and dynamics for handling reports made by whistleblowers, identifying and removing possible factors that could in some way prevent or obstruct the use of the whistleblowing mechanism.

In this regard, this internal policy aims to provide potential whistleblowers with clear operational instructions on the subject, contents, recipients and methods of transmission of such reports, as well as on the forms of protection offered in line with regulatory provisions.

3. DEFINITIONS

Before expanding on the technical and operational details of the whistleblowing procedure, the definitions of certain terms and concepts used in this Protocol are given below.

Whistleblower: the natural person who makes a report or public disclosure of information on violations acquired in the context of their employment.

Whistleblowers may be:

• job candidates, for information on violations acquired during the selection process or in other pre-contractual stages only;
• employees, including those employed on probationary or trial periods;
• former employees, for information on violations acquired during the employment relationship only;
• paid or unpaid volunteers or interns who work for the company;
• persons with management, direction, control, supervision or representation functions, also on a de facto basis, at the company;
• self-employed workers, freelancers, consultants;
• workers, both employed and self-employed, and collaborators working for suppliers/customers.

Facilitator: a natural person who assists a whistleblower in the reporting process, operating within the same professional context, whose assistance must be kept confidential.

Reported person or person concerned: the natural or legal person mentioned in the internal or external report or in the public disclosure as the person to whom the violation is attributed or as a person otherwise implicated in the reported or publicly disclosed breach.

Report: the written or oral communication of information on violations using the internal channel described in paragraph 5 below.

Disclosure: making information about violations publicly available through print, electronic media or other means of disclosure capable of reaching a large number of people.

4. REPORT SPECIFICATIONS

1. 1. OBJECT OF HE REPORT

For private-sector entities, the use of internal and external reporting channels is envisaged, i.e. public disclosures or reports to the judicial or tax authorities, with reference to the following areas {Art. 2(1)(a)(2), (3), (4), (5) and (6)}:

• • • unlawful conduct pursuant to Legislative Decree no. 231/2001, or violations of the Organisation and Management models provided for therein;
    • unlawful conduct falling within the scope of the European Union or domestic acts indicated in the Annex to Legislative Decree no. 24/2023 or of the domestic acts that constitute the implementation of the European Union acts indicated in the Annex to Directive (EU) 2019/1937, relating to the following areas: public procurement; services; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and animal welfare; public health; consumer protection; protection and privacy of personal data and security of networks and information systems;
    • acts or omissions affecting the financial interests of the Union as referred to in Article 325 of the Treaty on the Functioning of the European Union specified in the relevant secondary law of the European Union;
    • acts or omissions relating to the internal market, as referred to in Article 26, paragraph 2 of the Treaty on the Functioning of the European Union, including infringements of EU competition and State aid rules, as well as infringements relating to the internal market regarding acts in violation of corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that frustrates the object or purpose of the applicable corporate tax law;
    • acts or conduct that frustrate the object or purpose of the provisions of Union acts in the areas referred to in the preceding paragraphs.

** ** **

1. 2. CONTENT OF THE REPORT

The report should preferably contain the following elements:

• a clear and complete description of the reported facts, such as information, including reasonable suspicions, concerning violations committed or, on the basis of concrete evidence, are likely to be committed in the organisation with which the whistleblower or person making the report to the judicial or tax authorities has a legal relationship, as well as elements concerning conduct aimed at concealing such violations;
• if known, the time and place in which the acts were committed;
• if known, the personal details or other elements (such as job title and the department in which the job is carried out) that make it possible to identify the person(s) who has/have allegedly carried out the reported conduct;
• details of any other persons who may be able to provide information on the facts being reported;
• details of any documents that may confirm the validity of these facts;
• any other information that may prove useful in ascertaining the veracity of the reported facts.

1. 3. CASES EXCLUDED FROM THE APPLICATION OF THE WHISTLEBLOWINGREGULATIONS

Pursuant to Art. 1, paragraph 2, the provisions of Legislative Decree no. 24/2023 do not apply:

1. to objections, claims or demands linked to a personal interest of the whistleblower or the person making a report to the judicial or tax authorities that relate exclusively to their individual professional or employment relationships, or inherent to their professional or employment relationships with hierarchically superior persons;
2. to reports of violations where already mandatorily regulated by the European Union or domestic acts indicated in Part II of the Annex to Legislative Decree no. 24/2023 or by domestic acts that constitute implementation of the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, even if not indicated in Part II of the Annex to the said Decree;
3. national security breaches, as well as reports regarding procurement for defence or national security aspects, unless these aspects are covered by relevant secondary EU law.

This is without prejudice to the rules on: (i) classified information; (ii) medical and forensic secrecy; (iii) secrecy of court proceedings; (iv) rules of criminal procedure on the obligation of secrecy of investigations; (v) provisions on the autonomy and independence of the judiciary; (vi) national defence and public order and security; (vii) as well as the exercise of the right of workers to consult their representatives or trade unions.

5. WHISTLEBLOWING CHANNELS

In line with the new regulatory provisions on the protection of persons who report unlawful or irregular conduct that has come to their attention in the course of their professional activities, BMC S.r.l. is establishing special alternative and dedicated whistleblowing channels.

The management of the whistleblowing channel will be entrusted to an external, independent entity with specifically trained staff, namely Studio Legale Cerri Bini & Gualandi Avvocati Associati, with offices at Via Cavallotti, 21, Medicina (BO), Italy.

Reports may be made in writing or orally.

Internal reports, whether written or oral, submitted to the incorrect person shall be forwarded, within seven days of its receipt, to the correct and competent person, simultaneously notifying this transmission to the whistleblower.

The external entity entrusted with the management of the internal whistleblowing channel is responsible for the following activities:

1. issuing the whistleblower with an acknowledgement of receipt of the report within seven days of receipt;
2. maintaining dialogue with the whistleblower and requesting further information from the same where necessary;
3. diligently processing the reports received, taking any action necessary to assess the veracity of the facts reported, the outcome of the investigations and any measures taken;
4. providing a response to the report within three months of the date of the acknowledgement of receipt or, in the absence of such notice, within three months of the expiry of the seven-day period from the submission of the report;
5. providing clear information on the channel, procedures and requirements for making internal reports, as well as on the channel, procedures and requirements for making external reports. The aforementioned information is displayed and made easily visible in the workplace, as well as accessible to persons who, although not attending the workplace, have a legal relationship in one of the forms referred to in Article 3, paragraphs 3 or 4 of Legislative Decree no. 24/2023 (the definition of such relationships is provided in the “Whistleblower” section of this document, paragraph 3, page 7). BMC S.r.l. shall also publish the information referred to in this document in a dedicated section of its website.

The channels detailed below are to be considered autonomous and independent of each other.

1. 1. INTERNAL CHANNEL: REPORTING BY PHYSICAL MAIL

BMC S.r.l. may receive reports by physical (or paper) mail.

Whistleblowers must send their reports by physical mail in accordance with the following procedure, with the submission of three envelopes:

1. the first containing the identity data of the whistleblower together with a photocopy of their identity document and an address to which subsequent updates should be sent;
2. the second containing the report, so as to separate the identification data of the whistleblower from the content of the report itself;
3. the third envelope, in which the aforementioned envelopes (a) and (b) shall be inserted, shall be sealed and addressed to i) the external manager of the internal whistleblowing channel, currently Studio Legale Cerri Bini & Gualandi Avvocati Associati, Via Cavallotti, 21, 40059 Medicina (BO), Italy, marked “confidential”; or ii) the function appointed by BMC, currently Mr. Guido Cocci at BMC S.r.l. Via Roslè n. 115 40059 Medicina (BO), Italy, marked “confidential”, in the event that the report concerns the external entity entrusted with the management of the internal whistleblowing channel, or in the event that said entity may have a potential interest in the content of the report such as to compromise their impartiality and independence of judgement.

In order to protect the confidentiality of the whistleblower as much as possible, the recipient of a physical report in which the whistleblower has disclosed their identity, or which contains elements allowing the identity of the whistleblower to be traced, shall:

• record the report in a special hard-copy register in which the date of receipt of the report and all subsequent steps in the investigation are recorded;
• store the report in a sealed envelope inside a locked cupboard, and ensure that no copies are released to external parties;
• ensure that no complete copies (e.g., photocopies or scans) of the report are made: any duplicates shall be made by first anonymising the report by removing any reference to the whistleblower's identity;
• ensure that the identity data of the whistleblower are not recorded in any register or in any other document in any way related to the report;
• ensure that any communication of the report to other persons authorised to process it is handled with due respect for the confidentiality of the whistleblower, through the sending of anonymised copies or by simply describing the facts having removed any information that might allow the identity of the whistleblower to be traced.

In the event that the report concerns the external entity entrusted with the management of the internal reporting channel, Mr. Guido Cocci shall assume the role of Report Manager, taking all of the above precautions to protect the confidentiality of the whistleblower and conducting all the tasks described in detail in paragraph 6 below.

To protect the confidentiality of the whistleblower, reports may only be used to the extent necessary to adequately process them.

More information on the protection of the confidentiality of the whistleblower is given in paragraph 7.2.

1. 2. INTERNAL CHANNEL: ORAL REPORTS AND FACE-TO-FACE MEETINGS

BMC S.r.l. may receive the reports orally, through a dedicated telephone line no. +39 051 6971529 (calls not recorded) or, at the request of the whistleblower, through a direct meeting with the Report Manager, which shall be arranged within a reasonable time. The authorised function, in this case Mr Guido Cocci, shall collect the information upon the presentation of the personal data processing disclosure.

The oral report will be documented by means of a detailed account and the contents must be verified and countersigned by the whistleblower. A copy of the signed report must be provided to the whistleblower and forwarded within 7 days to the external manager of the internal whistleblowing channel, currently Studio Legale Cerri Bini & Gualandi.

Requests for face-to-face meetings must be made to the function appointed by BMC, currently Mr. Guido Cocci, who will schedule an in-person meeting between the whistleblower and the external manager of the internal whistleblowing channel, currently Studio Legale Cerri Bini & Gualandi Avvocati Associati; the meeting shall be held within 7 days of the report.

1. 3. ANONYMOUS REPORTS

Reports from which the identity of the whistleblower cannot be established are considered anonymous; where substantiated, they are treated as ordinary reports and processed accordingly.

In cases of anonymous reports, reports to judicial authorities or public disclosure, in the event that the whistleblower is subsequently identified and retaliated against, retaliation protection measures shall apply.

1. 4. EXTERNAL CHANNEL (ANAC PLATFORM)

Whistleblowers may make an external report if, at the time of its submission, one of the following conditions is met:

1. the whistleblower has already submitted an internal report under Article 4 and the report has not been processed;
2. the whistleblower has reasonable grounds to believe that, if they were to make an internal report, the report would not be effectively processed or that the report might lead to a risk of retaliation;
3. the whistleblower has reasonable grounds to believe that the violation may constitute a clear and present danger to the public interest.

1. 5.  PUBLIC DISCLOSURE

With public disclosure, information on violations is brought into the public domain through the press or electronic media or otherwise through means of disclosure capable of reaching a large number of people.

The conditions for making a public disclosure are as follows:

1. an internal report that did not receive a response by the prescribed deadline was escalated to an external report to ANAC which, in turn, did not receive a response within a reasonable time limit.
2. the whistleblower has already made an external report directly to ANAC, which, however, has not provided a response to the whistleblower regarding the measures envisaged or adopted to process the report within a reasonable period of time.
3. the whistleblower makes a public disclosure directly because they have reasonable grounds to believe, based on concrete evidence and thus not on mere inferences, that the violation may pose a clear and present danger to the public interest.
4. the whistleblower makes a public disclosure directly because they have reasonable grounds to believe that the external report may entail a risk of retaliation or may not be effectively processed.

A person who represents a source of information to the press is not considered a whistleblower making a public disclosure as described above, since this falls outside the scope of the purpose pursued by Legislative Decree no. 24/2023.

6. DUTIES OF THE WHISTLEBLOWER

1. 1. VERIFICATION OF THE VALIDITY OF THE CONFIDENTIAL REPORT

The entity entrusted with the management of the whistleblowing channel, currently Studio Legale Cerri Bini & Gualandi Avvocati Associati, processes the report and, within seven days of its receipt, provides a response to the whistleblower person and carries out an initial investigation. The assessment must begin within 30 days of receipt of the report, unless an extension of a further 15 days is granted for justified reasons. The time limit for the conclusion of the procedure is set at 90 consecutive days from the date of receipt of the report, without prejudice to an extension of the time limit if the investigation is particularly complex; such extension and the reasons for it are to be communicated to the whistleblower.

The entity entrusted with the management of the whistleblowing channel verifies the veracity of the facts represented in the report by means of any action they deem appropriate, in compliance with the principles of impartiality, confidentiality and protection of the identity of the whistleblower: this may include obtaining information, with the adoption of the necessary precautions, from the whistleblower (also at their request) in paper form (collection of written comments and documents from the whistleblower), hearing from any other persons who may report on the reported events, and acquiring deeds and documents from the company.

Upon completion of the checks within the above deadline, the entity entrusted with the management of the whistleblowing channel informs the whistleblower of the status or outcome of the checks.

Conclusion of the process: Based on their assessment of the facts of the report, the entity entrusted with the management of the whistleblowing channel may decide, in the event of clear and manifest unfoundedness, to close and file the report by means of a reasoned decision that will be communicated to the whistleblower.

The entity entrusted with the management of the reporting channel shall order the direct filing of reports/communications in the event that:

1. there is a manifest lack of injury to the integrity of BMC S.r.l.;
2. the reported act does not in fact constitute an offence subject to the provisions of Legislative Decree no. 24/2023;
3. the report is manifestly unfounded due to the absence of factual elements capable of justifying an investigation;
4. the legal requirements for the application of the penalty are manifestly not met;
5. the intervention of the entity entrusted with the management of the whistleblowing channel is no longer current;
6. the report is motivated by an overtly emulative purpose;
7. the report/communication is ascertained to consist of content that is generic or does not enable a clear understanding of the facts, or is accompanied by inappropriate or irrelevant documentation;
8. the documentation provided is not accompanied by a report of unlawful or regular conduct;
1. there is a lack of data constituting the essential elements of the report/communication.

If it appears that the report may not be manifestly unfounded, the entity entrusted with the management of the whistleblowing channel shall forward the report - also for the adoption of consequential measures - to the competent third parties:

• the Chairman of the Board of Directors, Mr. Gaetano Bergami, for the acquisition of evidence, or Mr. Guido Cocci if the whistleblowing report concerns the Chairman;
• the Head of Human Resources, Dr. Anna Bergami, for possible disciplinary liability profiles, or Mr. Guido Cocci if the whistleblowing report concerned the Head himself;

In line with current data protection law, in order to protect the purposes of the investigation and in the cases provided for by law, the reported person may not be immediately made aware of the processing of their personal data by the data controller, provided that informing them of such risks jeopardising the possibility of effectively verifying the grounds of the report or gathering the necessary evidence. Such deferrals will be assessed, on a case-by-case basis, by the entity entrusted with the management of the whistleblowing channel, in agreement with the data controller, taking due account of the interest in protecting the evidence and avoiding its destruction or alteration by the reported person, as well as of the wider interests at stake.

The reported data and documents are retained for five years from the date of receipt of the report or for a longer period when required for a final judgement or other judicial decision.

1. 2. VERIFICATION OF THE VALIDITY OF ANONYMOUS REPORTS

The phase of verifying the validity of the report by the entity entrusted with the management of the whistleblowing channel is similar for both confidential and anonymous reports.

For the handling of all other aspects, however, please refer to the provisions on confidential reports.

7. PROTECTION OF THE WHISTLEBLOWER

1. 1. PROHIBITION OF RETALIATION

BMC S.r.l. does not tolerate any prejudicial act towards the whistleblower in the form of disciplinary action, and prohibits the adoption of retaliatory action against whistleblowers as well as against the other beneficiaries of the protection measures.

Retaliation is understood as any conduct, act or omission, even if only attempted or threatened, occurring as a result of the report, report to the judicial or tax authorities or public disclosure, and which causes or is likely to cause the whistleblower unjust damage, either directly or indirectly.

For example, the following constitute retaliation against a whistleblower:

1. dismissal, suspension or equivalent measures;
2. demotion or non-promotion;
3. change of duties, change of workplace, reduction of salary, change of working hours;
4. suspension of training or any restriction of access to it;
5. negative performance assessment or employment reference;
6. the adoption of disciplinary measures or other sanctions, including a financial penalty;
7. coercion, intimidation, harassment or ostracism;
8. discrimination or otherwise unfavourable treatment;
1. the failure to convert a fixed-term employment contract into a permanent employment contract, where the employee had a legitimate expectation of such conversion;

50. failure to renew, or early termination of, a temporary employment contract;
1000. harm, including to a person's reputation, in particular on social media, or economic or financial loss, including loss of business and loss of income;
14. blacklisting on the basis of a sector-wide informal or formal agreement, which may result in the person being unable to find employment in the sector in the future;
15. early termination or cancellation of the contract for goods or services;
16. cancellation of a licence or permit;
17. the request to undergo psychiatric or medical examinations.

In the context of judicial or administrative proceedings or, in any case, out-of-court disputes concerned with investigating conduct, acts or omissions that may potentially constitute retaliation against the persons referred to in Article 3(1), (2), (3) and (4) of Legislative Decree no. 24/2023, it is presumed that any such actions have been taken as a direct result of the report, public disclosure or report to the judicial or tax authorities. The burden of proving that such actions are motivated by reasons unrelated to the report or public disclosure shall be borne by the opponent of the whistleblower.

In the event of a claim for damages filed with the judicial authorities by the persons referred to in Article 3(1), (2), (3) and (4) of Legislative Decree no. 24/2023, if such persons prove that they have made a report, a public disclosure or a report to the judicial or accounting authorities pursuant to the aforementioned decree and have suffered damage, it shall be presumed, unless proven otherwise, that the damage is the consequence of the report, public disclosure or report to the judicial or tax authorities.

If the whistleblower or the other persons indicated in Article 3, paragraph 3 of Legislative Decree no. 24/2023 consider that they have been subjected to discriminatory measures, they may refer the matter to the ANAC, which may involve the National Labour Inspectorate, for the matters falling under its remit.

In case of suspicion of discrimination or retaliation against the whistleblower related to the report, or of abuse of the reporting mechanism by the whistleblower, BMC S.r.l. shall provide for the application of disciplinary sanctions.

The aforementioned protection is, however, limited in the event the whistleblower is found to be liable either criminally, for offences of defamation or slander or, in any case, for the same offences committed in making the report to the judicial or tax authorities, or civilly, in cases of wilful misconduct or gross negligence, even in a court of first instance; in such a case, the whistleblower shall be subject to disciplinary action.

Finally, it is noted that, pursuant to Art. 22 of Legislative Decree no. 24/2023, waivers and settlements, whether in whole or in part, which have as their object the rights and protections provided for by this decree are not valid, unless they are made in the form and manner provided for by Articles 185, 410, 411, 412-ter and 412-quater of the Code of Civil Procedure and therefore in court or before the conciliation commission or in conciliation/arbitration provided for by the CCNL or by Article 412-quater of the Code of Civil Procedure.

1. 2. PROTECTION OF CONFIDENTIALITY

BMC S.r.l. guarantees the confidentiality of the whistleblower, ensuring that the identity of the latter - or any other information from which the identity thereof can be inferred, directly or indirectly - cannot be revealed, without the express consent of the whistleblower, to persons other than those responsible for receiving or processing the reports, expressly authorised to process such data in accordance with Articles 29 and 32(4) of Regulation (EU) 2016/679 and Article 2-quaterdecies of the Personal Data Protection Code set out in Legislative Decree no 196 of 30 June 2003.

In the context of any disciplinary proceedings initiated against the reported person, the identity of the whistleblower may not be disclosed in the event that said disciplinary proceedings are based on investigations that are separate from and additional to the report, even if consequent to it. If the disciplinary proceedings are based, in whole or in part, on the report and if disclosure of the identity of the whistleblower is indispensable to the defence of the person concerned, the report may be used for the purposes of the disciplinary proceedings only if the whistleblower expressly consents to the disclosure of their identity.

The whistleblower shall be notified in writing of the reasons for the disclosure of confidential data, in the cases referred to in Article 12, paragraph 5, second sentence, of Legislative Decree no. 24/2023 and in the internal and external whistleblowing procedures referred to in Chapter II of the aforementioned decree, in the event that disclosure of the identity of the whistleblower and of the information referred to in Article 12, paragraph 2 is indispensable for the defence of the person concerned.

BMC S.r.l. shall protect the identity of the persons concerned and of the persons mentioned in the report until the conclusion of the proceedings initiated as a result of the report, applying the same protections provided to the whistleblower.

In the internal and external whistleblowing procedures referred to in Chapter II of the aforementioned decree, the person concerned may be heard, or, at their request, shall be heard, also by means of documentary evidence provided in the form of written observations and documents.

Whistleblowers who make a public disclosure shall benefit from the protection provided by law if, at the time of the public disclosure, one of the following conditions is met:

1. the whistleblower has previously made an internal and external report or has made an external report directly, under the conditions and in the manner laid down in Articles 4 and 7 of Legislative Decree no. 24/2023, and no reply has been given within the time limits laid down in Articles 5 and 8 concerning the measures envisaged or adopted to process reports;
2. the whistleblower has reasonable grounds to believe that the violation may constitute a clear and present danger to the public interest;

3. the whistleblower has reasonable grounds to believe that the external report may involve a risk of retaliation or may not be effectively processed due to the specific circumstances of the case, such as in cases where evidence may be concealed or destroyed, or where there is a well-founded fear that the person to whom the report was submitted may be colluding with the perpetrator or be involved in the violation itself.

1. 3. SUBJECTIVE EXTENSION OF PROTECTION MEASURES

The protection measures contemplated by Legislative Decree no. 24/2023 apply to the whistleblower as well as to a) facilitators, i.e. the natural persons who assist a whistleblower in the reporting process, who operate within the same professional context as them and whose assistance must be kept confidential; b) persons in the same professional context as the person who made a report, public disclosure or report to the judicial or tax authorities, and who are linked to them by a concrete emotional or family relationship up to the fourth degree; c) co-workers of the person who made a report, public disclosure or report to the judicial or tax authorities, who work in the same professional environment as them and who have a consistent and current relationship with them; d) entities owned by the person who made a report, public disclosure or report to the judicial or tax authorities, as well as entities that work in the same professional environment as them.

This protection also applies in cases of whistleblowing reports or reports to the judicial or tax authorities or public disclosure in anonymous form, if the whistleblower is subsequently identified and subject to retaliation, as well as in cases of reporting to the institutions, bodies and competent bodies of the European Union, in accordance with the conditions set out in Article 6 of Legislative Decree no. 24/2023.

8. LIABILITY OF THE WHISTLEBLOWER

The legislation does not affect criminal and disciplinary liability in the event of slanderous or defamatory reports pursuant to the Italian Criminal Code and Article 2043 of the Italian Civil Code.

Any form of abuse of this protocol, such as manifestly opportunistic reports and/or reports made with the sole purpose of harming the reported person or other persons and any other case of improper use or intentional exploitation of the mechanism covered by this protocol, as well as unfounded reports made with gross negligence, shall be cause for liability in disciplinary and other competent fora.

However, pursuant to Art. 20 of Legislative Decree 24/2023, whistleblowers that disclose information on violations covered by the obligation of secrecy, other than as referred to in Article 1, paragraph 3 (i.e., relating to: (a) classified information; (b) forensic and medical professional secrecy; (c) secrecy of the deliberations of judicial bodies), or relating to the protection of copyright or the protection of personal data, or that disclose information on breaches that may harm the reputation of the reported person, are exempt from all forms of liability (criminal, civil and administrative). This exemption from liability applies on the condition that, at the time of disclosure, there were reasonable grounds to believe that the disclosure of the information was necessary to disclose the violation and the report was made pursuant to Article 16 (existence of reasonable grounds to believe that the information on the reported violations was true and fell within the objective scope of Article 1, i.e., that it concerned violations of domestic or European Union law affecting the public interest or the integrity of the institution).

In any event, criminal liability and any other liability, including civil or administrative liability, is not excluded for conduct, acts or omissions that are not related to the report or public disclosure or that are not strictly necessary to disclose the breach.